Picture the scene: the final minutes of the Law Society Risk and Compliance Conference 2026. Everyone is in a food coma, an information coma, a networking coma. It’s been a long day.
Then, suddenly, backs straighten. The closing question lands: should firms be conducting sanctions checks on counterparties as standard, even for routine, UK-based work?
The panel’s answer was unequivocal: yes.
It’s the sanctions regime, stupid
The SRA put out guidance three or four years ago on counterparty due diligence, as part of the wider push to get the profession comfortable with sanctions. After Russia’s invasion of Ukraine, sanctions went from niche specialist topic to everyone’s problem.
But do firms actually screen counterparties in day-to-day practice? The big global firms generally do: international work increases the odds of bumping into a designated person, and higher-profile clients tend to come with juicier profiles and higher resources. The traditional High Street firm, meanwhile, often doesn’t.
Was the panel right to say that everyone should be? Yes, they were.
The reason is simple (and slightly terrifying): the UK sanctions regime is strict liability. In other words, “we took a sensible risk-based approach” is not a get-out-of-jail-free card. The difficulty is that the UK financial sanctions regime is strict liability. That means a sensible risk-based approach is not, by itself, a complete answer if a breach has in fact occurred.
So, on paper, the safest position looks obvious: screen counterparties as a matter of standard practice, and keep evidence that you did.
The truth hurts
In practice, though, it’s messier.
What the conference slot didn’t have time for was the awkward bit: how, exactly, firms are supposed to meet that standard in the real world. There are several very practical barriers.
First, you need enough information about the counterparty to run a meaningful check. Sometimes you’ll have it: the name is in the contract pack; the individual is clearly identified. If the counterparty is an entity though, it can get murky quickly. Even for a company, working out who ultimately owns or controls it isn’t always straightforward. Many e-verification systems still struggle with ultimate beneficial ownership, and Companies House doesn’t always provide a neat answer either. The PSC register helps, but it is not the same thing as establishing the UBO.
When you hit these issues with your own client, you can usually resolve them without too much drama: ask questions, obtain documents, verify, move on.
When the person you need information about is not your client, the picture is cloudier. You can ask the other side, and sometimes they’ll cooperate because they understand what you’re doing. Other times, particularly if matters are even slightly contentious, you’ll meet resistance. Reasons vary from the reasonable (data protection, confidentiality, privilege) to the less noble (tactical delay) to the obvious (they’re hiding something).
And even if you have a name, it may be misspelt, incomplete, or the person may be known (or designated) under a different name. Because they aren’t your client, you can’t simply demand documents to tidy things up.
Then there’s the “possible match” problem. Even if you’ve avoided asking awkward questions so far, you may have to start. To clear a match you might need a date of birth, nationality, address history, information about what they do for a living – something to prove your counterparty is not the individual your screening tool is politely suggesting they might be.
The awkward reality of counterparty sanctions screening
There’s also the social embarrassment. Imagine you’re acting on the sale of a modest terraced house in a town where the wildest local scandal is someone parking across someone else’s driveway. You run the buyer’s name through screening and, of course, you get a hit. You ask your client if they know whether the buyer is the same person as the one flagged. Your client quite reasonably has no idea and no appetite to guess. The estate agent is equally unhelpful. Inside, you are 99% sure you are not dealing with a fugitive war criminal, arms dealer, or oligarch. But the only way to get proper comfort is to ask the other side for more information. You can have a wry smile about it if you’ve got a good relationship. If you don’t though, expect less mirth and more suspicion.
And even if the other side helps, can you rely on what you’re told? Strict liability means that its hard to feel reassured. If you take the cautious route, you’ll want supporting documentation. The more intrusive the requests become, the more twitchy counterparties tend to get.
You also need to decide how you’ll screen. You can use the UK Sanctions List for free. It works, but it’s clunky, and you’ll end up taking screenshots for your file. And remember: a manual check is a snapshot. It tells you what was true at 10:17am on Tuesday, not what will be true tomorrow.
The safer, and frankly, easier, option is an electronic screening service (often bundled with electronic ID/AML checks). It’s faster, can be set to re-screen, and reduces user error (assuming the name is entered correctly, which is a big assumption on some days). But it costs money.
Which raises the next practical question: who pays? The client is already paying for due diligence on themselves. Many will accept that (grudgingly, perhaps) because they’ve seen electronic ID checks everywhere from banks to letting agents. But paying to screen the other side can feel, to clients, like being asked to fund someone else’s compliance problem. And if the firm down the road isn’t doing it, your explanation may fall on deaf ears.
Or does the firm absorb the cost? Some will, on the basis that sanctions risk is a firm risk. Of course, that cost will reappear later when pricing structures are reviewed upwards, tied to a justification which focuses on the growing burden of regulation.
Lastly, let’s not forget the questions about what you do with any data you have collected. You’ll need to think about storage and destruction, you’ll need to think about how your responsibilities under the GDPR interact with what you are holding. Even if you’ve used the electronic screening system so it refreshes and picks up any changes, you’ll need to think about how you turn that off.
So we circle back. In strict terms, the answer is still yes: you should be screening counterparties as standard. But the route from theory to practice is beset with potholes. While a risk-based approach may not save you as a defence, in practical terms it is often the only workable way to design proportionate controls around counterparty screening. So:
- Do a proper, realistic sanctions risk assessment. Don’t rely on a template you haven’t read since 2022.
- Build a nuanced counterparty screening policy and procedure. Even if the chance of a sanctioned counterparty feels remote, think through when and how one could appear and what information you’d need to be comfortable. Use staff investigation or instincts where appropriate, and consider what intelligence a client can reasonably provide. Be readier to screen when the circumstances warrant it.
- Leverage checks done by others (carefully). Many estate agents conduct AML checks on both buyer and seller. That is not a reliance agreement – and strict liability means the risk still falls on your head anyway – but a cooperative agent may be able to share what information they have.
- Be upfront with the other side. From the start of the transaction, flag that you may be screening their client and may need cooperation to clear matches. As ever, a phone call at the right time can save five emails and a simmering grudge.
- Decide what screening you will run, and when. If you use manual checks against the UK Sanctions List, remember they are “as at” checks only. Think about building in refresh points: pre-exchange and pre-completion are obvious candidates.
- Train, train, train. Sanctions aren’t a box to tick “if relevant”. Staff should understand the seriousness of a breach and have a workable sense of higher-risk jurisdictions or industries or, at minimum, know where to check.
- Finally, remind everyone: there are UK citizens on the sanctions lists. Even if your client base feels low risk, you can’t choose who might pop up on the other side.
